Sekoia: AI Agents and ISOC Reshape Security Operations Centres
Integrated platforms and autonomous agents are changing how teams investigate alerts, reducing fatigue and elevating human judgment.
Key points
- Gartner introduces the ISOC category to challenge traditional SIEM models by integrating multiple security capabilities.
- AI agents handle repetitive triage and investigation tasks, allowing human analysts to focus on critical thinking.
- Human analysts act as mentors to AI, improving reasoning and challenging automated investigation results.
Sekoia’s Chief Solution Officer David Bizeul explains how integrated security operations centres and AI agents are reshaping the role of human analysts in cybersecurity teams.
Root cause
Traditional security information and event management systems have dominated the industry for nearly two decades without significant challenge. Gartner has now introduced the integrated security operations centre category to address the limitations of these standalone tools. The shift aims to consolidate disparate cybersecurity capabilities into a single platform rather than forcing teams to connect separate applications.
Attack path
The new model integrates core data ingestion with cyber threat intelligence and security orchestration, automation and response. AI agents support various stages of the workflow, including triage, investigation and detection engineering. These agents operate either autonomously or alongside human staff to process large volumes of data at speeds humans cannot match.
Affected versions
The source material does not specify software versions, CVE identifiers or affected products. The discussion centres on the ISOC market category defined by Gartner and the broader operational shift towards AI-augmented security centres described by Sekoia.
Mitigation
- Monitor vendor announcements regarding integrated security operations centre solutions that combine SIEM, CTI and SOAR capabilities.
- Evaluate how AI agents can be deployed to handle repetitive triage and investigation tasks within existing workflows.
- Identify which analytical tasks require human critical thinking and skepticism to ensure proper oversight of automated results.
Why it matters
Teams usually face alert fatigue when managing disparate security tools. Integrated platforms reduce the context switching required to investigate incidents. AI agents can process telemetry faster than humans, but they lack inherent skepticism. Analysts must verify automated findings to prevent false positives. Human experts should focus on mentoring agents, teaching them new threat patterns. This collaboration ensures that automation supports rather than replaces professional judgment in complex investigations.
What to do and how to stay safe: Sekoia
- Review current tool fragmentation to identify opportunities for integrated platform adoption.
- Define clear boundaries for autonomous agent actions versus tasks requiring human approval.
- Train analysts to critique and improve the reasoning logic of AI systems.
- Establish metrics to measure the reduction in repetitive tasks handled by automation.
Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is an ISOC?
Integrated Security Operations Center Solutions is a new Gartner category that combines SIEM, CTI and SOAR capabilities into one platform.
Do AI agents replace human analysts?
No, analysts work at a higher level, focusing on critical thinking and mentoring AI agents while agents handle repetitive tasks.
What skills become more important for analysts?
Critical thinking, skepticism and the ability to challenge investigation results become more important as AI handles speed and volume.
